Since the launch of AI technology, such as chatGPT, cyber-attacks have become increasingly sophisticated. Detecting these threats has consequently become a challenging task, leaving many businesses vulnerable to breaches that jeopardize their personal data, finances, and reputation. In this blog, we will present real-life examples of AI’s influence and discuss its crucial role in defending against and mitigating cyber-attacks.
Cyber-criminals are utilising AI technologies to enhance their attack strategies, making it far harder to identify and mitigate incoming threats – and here are a few examples:
“85% of surveyed organisations experienced phishing and social engineering attacks in 2021”
Accenture
Attackers now employ AI algorithms to craft highly convincing and personalised phishing emails, exploiting individuals’ trust and increasing the success rate of such attacks.
Here is a real-life example: A cyber-criminal who utilises AI-powered algorithms to generate highly personalised phishing emails.
How it works?
The attacker targets a specific company, gathers publicly available information about its employees from social media platforms, professional networking sites, or leaked data from previous breaches on the Dark Web.
The AI algorithm such as ChatGPT, then analyses this information to create tailored email content that appears genuine and trustworthy. It goes beyond the generic “Dear Sir/Madam” approach and includes specific details such as the recipient’s name, job title, recent projects, or current events related to the company. The email may even mimic the writing style and tone of the target individual, making it harder to detect as a fraudulent message.
By incorporating these personalised elements, the phishing email increases the likelihood of tricking the recipient into clicking on malicious links, downloading attachments, or divulging sensitive information like login credentials. This tactic exploits individuals’ trust in familiar information and familiarity with their peers, increasing the success rate of the attack and potentially leading to data breaches or other security incidents.
Tip: to avoid becoming a victim of cyber-crime, always remain vigilant, by being cautious of suspicious emails, and implementing strong security practices, such as multi-factor authentication, can help businesses protect themselves from such attacks
“350,000 new malicious programs discovered daily”
AV-TEST
Cyber criminals continuously modify malware to evade traditional detection methods. Polymorphic malware, capable of changing its code structure, posing a significant challenge for security systems, and makes it more difficult to detect and prevent attacks effectively.
Emotet a real trojan malware AI tool that cyber-criminal use.
In 2019, a sophisticated malware campaign known as Emotet gained notoriety for its use of polymorphic techniques. Emotet is a banking trojan that primarily targets financial institutions but also affects businesses across various industries. The malware spreads through phishing emails and malicious attachments.
What Emotet does?
Emotet’s creators continuously modify its code structure, making it morph and change with each distribution. By altering its signature and appearance, the malware evades traditional antivirus and security systems that rely on identifying known patterns or signatures.
Additionally, Emotet employs social engineering tactics to trick recipients into opening infected email attachments or clicking on malicious links. The malware generates convincing emails, often appearing as legitimate messages from trusted sources, such as colleagues or financial institutions. These emails are personalised and tailored to appear relevant and compelling to the recipient.
Once a user interacts with the infected attachment or link, Emotet gains a foothold in the victim’s system, allowing it to spread laterally and establish persistence. Emotet is also known for its ability to download additional malware onto compromised systems, such as other banking trojans or ransomware, amplifying the potential damage.
The polymorphic nature of Emotet, combined with its social engineering tactics, has made it a particularly challenging threat for cyber security professionals. It highlights the need for dynamic and behaviour-based detection techniques rather than solely relying on static signature-based defences.
This demonstrates how cyber criminals adapt and modify malware to bypass traditional security measures, emphasing the importance of employing advanced detection methods and staying vigilant against evolving threats.
Tip: Implement robust security practices. I.e., ensure all your systems and software are up to date with the latest security patches, as these OFTEN address vulnerabilities that malware can exploit. Use anti-virus and anti-malware software and keep them always up-to-date.
“There is a a 70% increase in zero-day vulnerabilities found in 2020 compared to the previous year”
Symantec's Internet Security Threat Report
Attackers exploit previously unknown vulnerabilities in software or systems (zero-day vulnerabilities), which have not yet been patched, gaining unauthorised access, and launching targeted attacks.
Zero-day vulnerability cyber-attack on EasyJet
In July 2020, EasyJet, a leading UK-based airline, disclosed a cyber-attack that affected the personal information of approximately nine million customers. The attackers exploited a previously unknown vulnerability in a third-party application used by the company.
The breach resulted in the unauthorised access to customer data, including email addresses and travel details. Additionally, around 2,200 customers had their credit card information exposed.
The impact of this attack on EasyJet was substantial. The company faced regulatory investigations, potential legal action, and a significant financial loss due to compensation and remediation efforts. Moreover, it caused concerns regarding customer trust and the security of personal information. This demonstrates how attackers can exploit zero-day vulnerabilities to target organisations and access sensitive customer data.
TIP: It’s important to continuously update and have a robust cyber security measure in place with prompt vulnerability management tools to stay protect against such threats.
